pqmsg_
Post-quantum end-to-end encrypted messenger.
ML-KEM-1024 (FIPS 203) · ML-DSA-87 (FIPS 204) · AES-256-GCM
what this is
pqmsg is an end-to-end encrypted messenger secured with post-quantum cryptography. Messages are encrypted on the sending device and can only be decrypted by the intended recipient's devices — the server stores and relays ciphertext only, and cannot read message content. Direct messages and groups, edits and reactions, replies, and file attachments (all inside the same encryption) — plus block, delete-a-chat, and account deletion. Install the client, create an account, and message anyone else with an account — no server address to configure, no separate service to sign up for.
download
Windows and Linux (AppImage) builds update themselves in the background — install once and the app keeps itself current. macOS updates are a one-click download from inside the app.
unsigned builds
Builds are not signed with a paid OS code-signing certificate. The operating system requires explicit confirmation before the first launch.
macOS
Right-click the app in Applications → Open → Open. If it reports the app as damaged, run once in Terminal:
xattr -cr "/Applications/pqmsg.app" sudo codesign --force --deep --sign - "/Applications/pqmsg.app"
The second line applies a local signature so macOS stops rejecting the app as unidentifiable — it asks for your Mac password, it does not send anything anywhere.
Windows
SmartScreen: More info → Run anyway.
Linux
.AppImage: chmod +x, then execute. .deb: sudo apt install ./pqmsg*.deb.
cryptographic primitives
| Key encapsulation | ML-KEM-1024 — FIPS 203 |
|---|---|
| Signatures | ML-DSA-87 — FIPS 204 |
| Message encryption | AES-256-GCM |
| Key derivation | HKDF-SHA-256 |
architecture
- Enrollment
- On first login the client generates an ML-KEM-1024 keypair and an ML-DSA-87 keypair locally, then signs an attestation binding both public keys to the account and device name. The server verifies the attestation and publishes the public keys to its identity directory. Private keys are never transmitted.
- Message encryption
- Each message is encrypted under a random AES-256-GCM key. That key is wrapped separately for every recipient device via ML-KEM-1024 encapsulation, and the resulting envelope is signed with the sender device's ML-DSA-87 key — the signature itself is the message's authentication, verified against that device's registered key. The server stores and relays the ciphertext; it cannot decrypt it.
- Authentication
- Login requires a password and a time-limited code sent to the account's registered email address. A trusted-device token can bypass the code on a given device for 30 days; a session otherwise stays signed in for 7 days idle. A network failure never forces a relogin — only an actually invalid or expired session does.
- Consistency
- Message order is authoritative on the server. Clients reconcile their local view against that order on a fixed interval and mark delivery per recipient device.